In May 2024 the US Public Company Accounting Oversight Board adopted QC 1000, A Firm's System of Quality Control, replacing quality control standards that had remained largely unchanged since the 1990s. The standard was approved by the SEC later that year.
The PCAOB subsequently postponed the effective date by one year, to 15 December 2026, giving firms additional time to design and test their systems. With that date now months away, firms that audit US-listed issuers and broker-dealers are completing their implementation work.
From checklists to risk-based quality management
QC 1000 follows the same broad philosophy as the IAASB's ISQM 1: instead of prescribing a fixed set of procedures, it requires each firm to set quality objectives, identify and assess risks to achieving them, and design responses. The system must be monitored, deficiencies investigated for root causes, and remediation tracked.
The standard covers governance and leadership, ethics and independence, acceptance and continuance of engagements, engagement performance, resources, information and communication, and monitoring and remediation.
Annual evaluation and reporting to the PCAOB
One of the most notable requirements is an annual evaluation of the quality control system as of 30 September, with conclusions reported to the PCAOB on a new form. Firms must identify an individual with ultimate responsibility and accountability for the system, and the evaluation must be certified by the responsible individuals.
Larger firms — those that audit more than 100 issuers — face additional requirements, including an external quality control function with at least one independent member to provide oversight.
Why audited companies should pay attention
Although QC 1000 is addressed to audit firms, its effects reach audit committees. Firms are required to communicate with audit committees about the firm's quality control system in specified circumstances, and the new monitoring regime may lead to more focused questions about data, technology and engagement team resourcing.
Audit committees can use the transition as an opportunity to ask their auditors how the new system has affected engagement quality, what the most recent evaluation concluded and how identified deficiencies are being remediated.
Relevance beyond the United States
Many non-US firms are registered with the PCAOB because they audit subsidiaries of US-listed groups or foreign private issuers. For these firms, QC 1000 applies alongside ISQM 1, and aligning the two frameworks without duplicating effort has been a major workstream.
Conclusion
QC 1000 turns quality control from a periodic compliance exercise into a continuous, evidence-based management system. For audit firms it is a significant operational change; for the companies they audit, it should translate into clearer accountability and better-evidenced audit quality.
